@did-btcr2/cli 0.14.0 → 0.16.0

package/dist/esm/src/cli.js

@@ -1,7 +1,7 @@
 import { DidMethodError } from '@did-btcr2/common';
 import { Command, CommanderError } from 'commander';
-import { registerCompletionCommand, registerConfigCommand, registerCreateCommand, registerDeactivateCommand, registerKeyCommand, registerProfileCommand, registerResolveCommand, registerUpdateCommand, } from './commands/index.js';
-import { defaultApiFactory, keystoreApiFactory } from './config.js';
+import { registerCompletionCommand, registerConfigCommand, registerCreateCommand, registerDeactivateCommand, registerInitCommand, registerKeyCommand, registerKeystoreCommand, registerProfileCommand, registerResolveCommand, registerUpdateCommand, } from './commands/index.js';
+import { defaultApiFactory, keystoreApiFactory, resolveOutputFormat } from './config.js';
 import { VERSION } from './version.js';
 /**
  * CLI tool for the did:btcr2 method.
@@ -26,10 +26,11 @@ export class DidBtcr2Cli {
         this.program = new Command('btcr2')
             .version(`btcr2 ${VERSION}`, '-v, --version', 'Output the current version')
             .description('CLI tool for the did:btcr2 method')
-            .option('-o, --output <format>', 'Output format <json|text>', 'text')
+            .option('-o, --output <format>', 'Output format <json|text> (default: config defaults.output, else text)')
             .option('--verbose', 'Verbose output', false)
             .option('--quiet', 'Suppress non-essential output', false)
-            .option('-c, --config <path>', 'Path to config file (default: $XDG_CONFIG_HOME/btcr2/config.json)')
+            .option('--home <dir>', 'btcr2 home directory holding config.json + keystore.json (default: ~/.btcr2, %LOCALAPPDATA%\\btcr2 on Windows; overrides $BTCR2_HOME)')
+            .option('-c, --config <path>', 'Path to config file (default: <home>/config.json)')
             .option('--profile <name>', 'Config profile name (default: auto-detected from network)')
             .option('--btc-rest <url>', 'Override Bitcoin REST endpoint (Esplora API)')
             .option('--btc-rpc-url <url>', 'Override Bitcoin Core RPC endpoint')
@@ -37,15 +38,31 @@ export class DidBtcr2Cli {
             .option('--btc-rpc-pass <pass>', 'Bitcoin Core RPC password')
             .option('--cas-gateway <url>', 'IPFS HTTP gateway for CAS reads (read-only)')
             .option('--cas-rpc-url <url>', 'IPFS HTTP RPC endpoint for a writable CAS (reads + writes; enables --publish-to-cas)')
-            .option('--keystore <path>', 'Path to the keystore file (default: $XDG_DATA_HOME/btcr2/keystore.json)')
+            .option('--btc-timeout <ms>', 'Bitcoin REST/RPC request timeout in milliseconds (default: unbounded)')
+            .option('--cas-timeout <ms>', 'CAS request timeout in milliseconds (default: 30000; 0 disables)')
+            .option('--btc-rest-header <header>', 'Extra Bitcoin REST header "Key: Value" (repeatable)', collectHeader, [])
+            .option('--btc-rpc-wallet <name>', 'Bitcoin Core wallet name for wallet-scoped RPCs')
+            .option('--btc-rpc-header <header>', 'Extra Bitcoin Core RPC header "Key: Value" (repeatable)', collectHeader, [])
+            .option('--keystore <path>', 'Path to the keystore file (default: <home>/keystore.json)')
             .option('--passphrase-file <path>', 'Read the keystore passphrase from a file (unattended use)')
             .option('--signing-key <ref>', 'Key for create/update/deactivate signing: a URN, fingerprint prefix, or name');
         const globals = () => this.program.opts();
+        // Resolve the effective output format (flag -> BTCR2_OUTPUT -> config
+        // defaults.output -> 'text') before any command action runs, so a configured
+        // default is honored while an explicit flag still wins. The commander option
+        // carries no hard default (which would mask defaults.output); the resolved
+        // value is written back so every command reads it through globals().output.
+        this.program.hook('preAction', () => {
+            const opts = this.program.opts();
+            opts.output = resolveOutputFormat({ output: opts.output, config: opts.config, home: opts.home });
+        });
+        registerInitCommand(this.program, globals);
         registerCreateCommand(this.program, factory, keystoreFactory, globals);
         registerResolveCommand(this.program, factory, globals);
         registerUpdateCommand(this.program, keystoreFactory, globals);
         registerDeactivateCommand(this.program, keystoreFactory, globals);
         registerKeyCommand(this.program, keystoreFactory, globals);
+        registerKeystoreCommand(this.program, globals);
         registerConfigCommand(this.program, globals);
         registerProfileCommand(this.program, globals);
         registerCompletionCommand(this.program, globals);
@@ -67,6 +84,13 @@ export class DidBtcr2Cli {
         }
     }
 }
+/**
+ * Commander collector for a repeatable header option: accumulates each
+ * `Key: Value` occurrence into an array, preserving order.
+ */
+function collectHeader(value, previous) {
+    return [...previous, value];
+}
 /**
  * Normalizes argv to ensure it has at least two elements.
  * @param {string[]} argv - The original argv array.

package/dist/esm/src/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAmB,MAAM,aAAa,CAAC;AAErF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,OAAO,CAAU;IAEjC;;;;;;;;;;;;;OAaG;IACH,YACE,UAAsB,iBAAiB,EACvC,kBAA8B,kBAAkB;QAEhD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;aAChC,OAAO,CAAC,SAAS,OAAO,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC;aAC1E,WAAW,CAAC,mCAAmC,CAAC;aAChD,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;aACpE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;aAC5C,MAAM,CAAC,SAAS,EAAE,+BAA+B,EAAE,KAAK,CAAC;aACzD,MAAM,CAAC,qBAAqB,EAAE,mEAAmE,CAAC;aAClG,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;aACvF,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;aAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;aACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,qBAAqB,EAAE,6CAA6C,CAAC;aAC5E,MAAM,CAAC,qBAAqB,EAAE,sFAAsF,CAAC;aACrH,MAAM,CAAC,mBAAmB,EAAE,yEAAyE,CAAC;aACtG,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;aAC/F,MAAM,CAAC,qBAAqB,EAAE,8EAA8E,CAAC,CAAC;QAEjH,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;QAE1E,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACvE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9D,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAClE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3D,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,IAAe;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,OAAgB;IACnD,IACE,KAAK,YAAY,cAAc;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAmB,MAAM,aAAa,CAAC;AAE1G,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,OAAO,CAAU;IAEjC;;;;;;;;;;;;;OAaG;IACH,YACE,UAAsB,iBAAiB,EACvC,kBAA8B,kBAAkB;QAEhD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;aAChC,OAAO,CAAC,SAAS,OAAO,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC;aAC1E,WAAW,CAAC,mCAAmC,CAAC;aAChD,MAAM,CAAC,uBAAuB,EAAE,wEAAwE,CAAC;aACzG,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;aAC5C,MAAM,CAAC,SAAS,EAAE,+BAA+B,EAAE,KAAK,CAAC;aACzD,MAAM,CAAC,cAAc,EAAE,uIAAuI,CAAC;aAC/J,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;aAClF,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;aACvF,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;aAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;aACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,qBAAqB,EAAE,6CAA6C,CAAC;aAC5E,MAAM,CAAC,qBAAqB,EAAE,sFAAsF,CAAC;aACrH,MAAM,CAAC,oBAAoB,EAAE,uEAAuE,CAAC;aACrG,MAAM,CAAC,oBAAoB,EAAE,kEAAkE,CAAC;aAChG,MAAM,CAAC,4BAA4B,EAAE,qDAAqD,EAAE,aAAa,EAAE,EAAE,CAAC;aAC9G,MAAM,CAAC,yBAAyB,EAAE,iDAAiD,CAAC;aACpF,MAAM,CAAC,2BAA2B,EAAE,yDAAyD,EAAE,aAAa,EAAE,EAAE,CAAC;aACjH,MAAM,CAAC,mBAAmB,EAAE,2DAA2D,CAAC;aACxF,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;aAC/F,MAAM,CAAC,qBAAqB,EAAE,8EAA8E,CAAC,CAAC;QAEjH,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;QAE1E,sEAAsE;QACtE,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;YAClD,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;QAEH,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACvE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9D,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAClE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3D,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,IAAe;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,QAAkB;IACtD,OAAO,CAAE,GAAG,QAAQ,EAAE,KAAK,CAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,OAAgB;IACnD,IACE,KAAK,YAAY,cAAc;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;AACzB,CAAC"}

package/dist/esm/src/commands/config.js

@@ -1,14 +1,14 @@
 import { existsSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { CONFIG_SCHEMA_VERSION, defaultConfigPath, getConfigPath, readConfigFile, setConfigPath, unsetConfigPath, writeConfigFile, } from '../config.js';
+import { CONFIG_SCHEMA_VERSION, defaultConfigPath, getConfigPath, parseConfigFileRaw, readConfigFile, resolveDefaultNetwork, resolveEffectiveConfig, resolveKeystorePath, runDoctor, setConfigPath, unsetConfigPath, writeConfigFile, writeDefaultConfigFile, } from '../config.js';
+import { findConfigIssues, validateConfigSet } from '../config-schema.js';
 import { CLIError } from '../error.js';
-import { ensureDir, writeFileAtomic } from '../keystore/atomic.js';
-import { formatResult } from '../output.js';
+import { formatResult, REDACTED, redactSecrets, scrubUrlUserinfo } from '../output.js';
+import { resolveHome } from '../paths.js';
 import { SUPPORTED_NETWORKS } from '../types.js';
 /** Registers the `config` command group for reading and writing CLI configuration. */
 export function registerConfigCommand(program, globals) {
     const config = program.command('config').description('Read and write CLI configuration.');
-    const path = () => globals().config ?? defaultConfigPath();
+    const path = () => globals().config ?? defaultConfigPath(globals());
     const print = (result) => console.log(formatResult(result, globals()));
     config
         .command('init')
@@ -19,27 +19,31 @@ export function registerConfigCommand(program, globals) {
         if (existsSync(p) && !options.force) {
             throw new CLIError(`Config already exists at ${p}. Use --force to overwrite.`, 'INVALID_ARGUMENT_ERROR', { path: p });
         }
-        const scaffold = {
-            schemaVersion: CONFIG_SCHEMA_VERSION,
-            defaults: { output: 'text' },
-            profiles: Object.fromEntries(SUPPORTED_NETWORKS.map(n => [n, {}])),
-        };
-        ensureDir(dirname(p), 0o700);
-        writeFileAtomic(p, `${JSON.stringify(scaffold, null, 2)}\n`, 0o600);
+        writeDefaultConfigFile(p);
         print({ action: 'config-init', data: { path: p } });
     });
     config
         .command('get [path]')
         .description('Print a value at a dotted path, or the whole config.')
-        .action((dotted) => {
+        .option('--show-secrets', 'Reveal secret values (RPC password, etc.) instead of redacting them.', false)
+        .action((dotted, opts) => {
         const file = (readConfigFile(path()) ?? {});
-        print({ action: 'config-get', data: (dotted ? getConfigPath(file, dotted) : file) ?? null });
+        const raw = (dotted ? getConfigPath(file, dotted) : file) ?? null;
+        const leaf = dotted ? dotted.split('.').pop() : undefined;
+        print({ action: 'config-get', data: opts.showSecrets ? raw : redactSecrets(raw, leaf) });
     });
     config
         .command('set <path> <value>')
         .description('Set a value at a dotted path. The value is parsed as JSON when valid, else stored as a string.')
         .action((dotted, value) => {
-        writeConfigFile(path(), raw => setConfigPath(raw, dotted, parseValue(value)));
+        const parsed = parseValue(dotted, value);
+        // Reject an invalid enum value for a known key up-front; warn (but still
+        // write) an unknown path so forward-compatible and third-party keys work.
+        const { unknownPath } = validateConfigSet(dotted, parsed);
+        if (unknownPath && !globals().quiet) {
+            console.error(`Warning: "${dotted}" is not a known config path; writing it anyway.`);
+        }
+        writeConfigFile(path(), raw => setConfigPath(raw, dotted, parsed));
         print({ action: 'config-set', data: { path: dotted } });
     });
     config
@@ -53,12 +57,95 @@ export function registerConfigCommand(program, globals) {
         .command('list')
         .alias('ls')
         .description('Print the entire config file.')
+        .option('--show-secrets', 'Reveal secret values (RPC password, etc.) instead of redacting them.', false)
+        .action((opts) => {
+        const file = readConfigFile(path()) ?? {};
+        print({ action: 'config-list', data: opts.showSecrets ? file : redactSecrets(file) });
+    });
+    config
+        .command('validate')
+        .description('Check the config for unknown keys, invalid enum values, and an unsupported schema version.')
+        .action(() => {
+        // Read raw (bypassing the schema-version ceiling that readConfigFile
+        // enforces) so a newer-than-supported version is reported as a finding
+        // rather than aborting the very command meant to diagnose it.
+        const file = parseConfigFileRaw(path()) ?? {};
+        const issues = findConfigIssues(file, CONFIG_SCHEMA_VERSION);
+        if (issues.length > 0)
+            process.exitCode ??= 1;
+        print({ action: 'config-validate', data: { ok: issues.length === 0, issues } });
+    });
+    config
+        .command('effective')
+        .description('Print the resolved connection config with per-value provenance (flag|env|file|default).')
+        .option('-n, --network <network>', 'Network to resolve for (default: config default network)')
+        .option('--show-secrets', 'Reveal secret values (RPC password) instead of redacting them.', false)
+        .action((opts) => {
+        const network = resolveIntrospectionNetwork(opts.network, globals());
+        const data = resolveEffectiveConfig(network, globals());
+        // Redact the resolved RPC password and any password embedded in an endpoint
+        // URL by default; provenance still shows where each value came from.
+        // --show-secrets reveals them for deliberate debugging.
+        if (!opts.showSecrets) {
+            if (data.btc.rpcPass.value !== undefined) {
+                data.btc.rpcPass = { ...data.btc.rpcPass, value: REDACTED };
+            }
+            for (const entry of [data.btc.rest, data.btc.rpcUrl, data.cas.gateway, data.cas.rpcUrl]) {
+                if (typeof entry.value === 'string')
+                    entry.value = scrubUrlUserinfo(entry.value);
+            }
+        }
+        print({ action: 'config-effective', data });
+    });
+    config
+        .command('path')
+        .description('Print the resolved home directory, config-file, and keystore paths.')
         .action(() => {
-        print({ action: 'config-list', data: readConfigFile(path()) ?? {} });
+        const g = globals();
+        const data = {
+            home: resolveHome(g),
+            config: g.config ?? defaultConfigPath(g),
+            // Diagnostic command: report the path even when the config is malformed
+            // (this is a command you run to find and fix a broken config).
+            keystore: resolveKeystorePath(g, { lenient: true }),
+        };
+        print({ action: 'config-path', data });
+    });
+    config
+        .command('doctor')
+        .description('Probe reachability of the resolved endpoints (read-only; touches the network).')
+        .option('-n, --network <network>', 'Network to resolve for (default: config default network)')
+        .action(async (opts) => {
+        const network = resolveIntrospectionNetwork(opts.network, globals());
+        const report = await runDoctor(network, globals());
+        if (report.checks.some(check => !check.ok))
+            process.exitCode ??= 1;
+        print({ action: 'config-doctor', data: report });
     });
 }
-/** Parses a value as JSON when valid, otherwise treats it as a plain string. */
-function parseValue(value) {
+/**
+ * Resolves the network an introspection command (`effective`/`doctor`) operates
+ * on: an explicit `--network`, validated, else the config's default network.
+ */
+function resolveIntrospectionNetwork(explicit, globals) {
+    if (explicit) {
+        if (!SUPPORTED_NETWORKS.includes(explicit)) {
+            throw new CLIError(`Invalid network "${explicit}". Must be one of ${SUPPORTED_NETWORKS.join(', ')}.`, 'INVALID_ARGUMENT_ERROR', { network: explicit });
+        }
+        return explicit;
+    }
+    return resolveDefaultNetwork(globals);
+}
+/**
+ * Parses a `config set` value. Known scalar endpoint, credential, and defaults
+ * paths are stored as raw strings so a bare `8080` is not coerced to the number
+ * `8080` (which would flow into a host field as a non-string). Every other path
+ * is parsed as JSON when valid, else stored as a plain string, so structured
+ * values (objects, arrays, booleans, and genuinely numeric fields) still work.
+ */
+function parseValue(dotted, value) {
+    if (isStringScalarPath(dotted))
+        return value;
     try {
         return JSON.parse(value);
     }
@@ -66,4 +153,29 @@ function parseValue(value) {
         return value;
     }
 }
+/**
+ * Whether a dotted config path addresses a leaf that must be stored as a string
+ * (an endpoint URL, a credential, a network/profile/output name), so JSON
+ * coercion never turns it into a non-string.
+ */
+function isStringScalarPath(dotted) {
+    const segments = dotted.split('.');
+    if (segments.length === 2 && segments[0] === 'defaults') {
+        return ['profile', 'network', 'output'].includes(segments[1]);
+    }
+    if (segments.length === 3 && segments[0] === 'profiles' && segments[2] === 'network') {
+        return true;
+    }
+    if (segments.length === 4 && segments[0] === 'profiles') {
+        const group = segments[2];
+        const leaf = segments[3];
+        if (group === 'btc')
+            return ['rest', 'rpcUrl', 'rpcUser', 'rpcPass', 'changeAddress', 'wallet'].includes(leaf);
+        if (group === 'cas')
+            return ['gateway', 'rpcUrl'].includes(leaf);
+        if (group === 'identity')
+            return ['keystore', 'default'].includes(leaf);
+    }
+    return false;
+}
 //# sourceMappingURL=config.js.map

package/dist/esm/src/commands/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/commands/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAA4B;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,SAAS,EAAE,oCAAoC,EAAE,KAAK,CAAC;SAC9D,MAAM,CAAC,CAAC,OAA4B,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,QAAQ,CAAC,4BAA4B,CAAC,6BAA6B,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,aAAa,EAAG,qBAAqB;YACrC,QAAQ,EAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;YAClC,QAAQ,EAAQ,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC;SAC3E,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,CAAC,MAAe,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;QACvE,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,gGAAgG,CAAC;SAC7G,MAAM,CAAC,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE;QACxC,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE;QACzB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,GAAG,EAAE;QACX,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/commands/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,SAAS,EACT,aAAa,EACb,eAAe,EACf,eAAe,EACf,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAA4B;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,SAAS,EAAE,oCAAoC,EAAE,KAAK,CAAC;SAC9D,MAAM,CAAC,CAAC,OAA4B,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,QAAQ,CAAC,4BAA4B,CAAC,6BAA6B,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,gBAAgB,EAAE,sEAAsE,EAAE,KAAK,CAAC;SACvG,MAAM,CAAC,CAAC,MAA0B,EAAE,IAA+B,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;QACvE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,gGAAgG,CAAC;SAC7G,MAAM,CAAC,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,EAAE,WAAW,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,aAAa,MAAM,kDAAkD,CAAC,CAAC;QACvF,CAAC;QACD,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACnE,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE;QACzB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,gBAAgB,EAAE,sEAAsE,EAAE,KAAK,CAAC;SACvG,MAAM,CAAC,CAAC,IAA+B,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4FAA4F,CAAC;SACzG,MAAM,CAAC,GAAG,EAAE;QACX,qEAAqE;QACrE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC9C,KAAK,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,yFAAyF,CAAC;SACtG,MAAM,CAAC,yBAAyB,EAAE,0DAA0D,CAAC;SAC7F,MAAM,CAAC,gBAAgB,EAAE,gEAAgE,EAAE,KAAK,CAAC;SACjG,MAAM,CAAC,CAAC,IAAiD,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,4EAA4E;QAC5E,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC9D,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,CAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAE,EAAE,CAAC;gBAC1F,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;oBAAE,KAAK,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,KAAK,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG;YACX,IAAI,EAAO,WAAW,CAAC,CAAC,CAAC;YACzB,MAAM,EAAK,CAAC,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAC3C,wEAAwE;YACxE,+DAA+D;YAC/D,QAAQ,EAAG,mBAAmB,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACrD,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,yBAAyB,EAAE,0DAA0D,CAAC;SAC7F,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACnE,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAAC,QAA4B,EAAE,OAAsB;IACvF,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAyB,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACjF,wBAAwB,EACxB,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,OAAO,QAAyB,CAAC;IACnC,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa;IAC/C,IAAI,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QACxD,OAAO,CAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,CAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjH,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,CAAE,SAAS,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,CAAE,UAAU,EAAE,SAAS,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/src/commands/create.js

@@ -1,5 +1,5 @@
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
-import { resolveDefaultNetwork } from '../config.js';
+import { assertKeystoreAllowedForNetwork, profileNetworkMismatch, resolveDefaultNetwork } from '../config.js';
 import { CLIError } from '../error.js';
 import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
 import { formatResult } from '../output.js';
@@ -45,6 +45,15 @@ export function registerCreateCommand(program, factory, keystoreFactory, globals
         const overrides = overridesFromGlobals(g);
         const network = resolveNetwork(options.network, overrides);
         const signingKey = g.signingKey;
+        // Warn (never block) when the network being encoded disagrees with the
+        // active profile's declared network, so a `production` profile holding
+        // mainnet endpoints cannot silently mint a regtest DID.
+        const mismatch = profileNetworkMismatch(network, overrides);
+        if (mismatch && !g.quiet) {
+            process.stderr.write(`Warning: creating a "${network}" identifier while the active profile `
+                + `"${mismatch.profile}" declares network "${mismatch.declared}". The `
+                + 'identifier\'s network and the profile\'s endpoints may not match.\n');
+        }
         /** Prints the result, plus a stderr provenance line in text mode. */
         const print = (result, note) => {
             console.log(formatResult(result, g));
@@ -86,6 +95,8 @@ export function registerCreateCommand(program, factory, keystoreFactory, globals
             return;
         }
         // Generate: mint a fresh key, persist it, and set it active (passphrase prompt).
+        // Refuse to seal a fresh mainnet key into an unencrypted dev keystore (ADR 080).
+        assertKeystoreAllowedForNetwork(network, overrides);
         const api = keystoreFactory(undefined, overrides);
         const { did, keyId } = api.generateDid({ network, setActive: true });
         const publicKey = bytesToHex(api.kms.getPublicKey(keyId));
@@ -95,6 +106,7 @@ export function registerCreateCommand(program, factory, keystoreFactory, globals
 /** Builds the keystore- and config-resolution overrides from the global flags. */
 function overridesFromGlobals(g) {
     return {
+        home: g.home,
         config: g.config,
         profile: g.profile,
         keystore: g.keystore,

package/dist/esm/src/commands/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../../src/commands/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,8FAA8F;AAC9F,MAAM,cAAc,GAAyD;IAC3E,CAAC,EAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE;IACvE,CAAC,EAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAyB,EACzB,OAA4B,EAC5B,eAA4B,EAC5B,OAAqC;IAErC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,GAAG,CAAC;SACzD,MAAM,CACL,yBAAyB,EACzB,kFAAkF;UAChF,kDAAkD,CACrD;SACA,MAAM,CACL,qBAAqB,EACrB,iCAAiC;UAC/B,uEAAuE;UACvE,6DAA6D,CAChE;SACA,MAAM,CAAC,KAAK,EAAE,OAA2D,EAAE,EAAE;QAC5E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAEhC,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAE,IAAa,EAAQ,EAAE;YAC3D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,4BAA4B;QAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,QAAQ,CAChB,iEAAiE,EACjE,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,QAAQ,CAChB,wFAAwF;sBACtF,4CAA4C,EAC9C,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,kDAAkD,EAClD,wBAAwB,CACzB,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,KAAK,CACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,EACxE,oBAAoB,KAAK,GAAG,CAC7B,CAAC;YACF,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,KAAK,CACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EACjD,4BAA4B,KAAK,wBAAwB,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,CAAgB;IAC5C,OAAO;QACL,MAAM,EAAW,CAAC,CAAC,MAAM;QACzB,OAAO,EAAU,CAAC,CAAC,OAAO;QAC1B,QAAQ,EAAS,CAAC,CAAC,QAAQ;QAC3B,cAAc,EAAG,CAAC,CAAC,cAAc;KAClC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,QAA4B,EAAE,SAA8B;IAClF,IAAI,CAAC,QAAQ;QAAE,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAyB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,QAAQ,CAChB,yGAAyG,EACzG,wBAAwB,EACxB,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,QAAyB,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,GAAW,EAAE,IAAe;IACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,0CAA0C,QAAQ,CAAC,KAAK,GAAG,EAC3D,wBAAwB,EACxB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAChB,kCAAkC,IAAI,eAAe,QAAQ,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,SAAS,EACjG,wBAAwB,EACxB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../../src/commands/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAAE,+BAA+B,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC9G,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,8FAA8F;AAC9F,MAAM,cAAc,GAAyD;IAC3E,CAAC,EAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE;IACvE,CAAC,EAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAyB,EACzB,OAA4B,EAC5B,eAA4B,EAC5B,OAAqC;IAErC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,GAAG,CAAC;SACzD,MAAM,CACL,yBAAyB,EACzB,kFAAkF;UAChF,kDAAkD,CACrD;SACA,MAAM,CACL,qBAAqB,EACrB,iCAAiC;UAC/B,uEAAuE;UACvE,6DAA6D,CAChE;SACA,MAAM,CAAC,KAAK,EAAE,OAA2D,EAAE,EAAE;QAC5E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAEhC,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,OAAO,wCAAwC;kBACrE,IAAI,QAAQ,CAAC,OAAO,uBAAuB,QAAQ,CAAC,QAAQ,SAAS;kBACrE,qEAAqE,CACxE,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAE,IAAa,EAAQ,EAAE;YAC3D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,4BAA4B;QAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,QAAQ,CAChB,iEAAiE,EACjE,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,QAAQ,CAChB,wFAAwF;sBACtF,4CAA4C,EAC9C,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,kDAAkD,EAClD,wBAAwB,CACzB,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,KAAK,CACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,EACxE,oBAAoB,KAAK,GAAG,CAC7B,CAAC;YACF,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,iFAAiF;QACjF,+BAA+B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,KAAK,CACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EACjD,4BAA4B,KAAK,wBAAwB,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,CAAgB;IAC5C,OAAO;QACL,IAAI,EAAa,CAAC,CAAC,IAAI;QACvB,MAAM,EAAW,CAAC,CAAC,MAAM;QACzB,OAAO,EAAU,CAAC,CAAC,OAAO;QAC1B,QAAQ,EAAS,CAAC,CAAC,QAAQ;QAC3B,cAAc,EAAG,CAAC,CAAC,cAAc;KAClC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,QAA4B,EAAE,SAA8B;IAClF,IAAI,CAAC,QAAQ;QAAE,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAyB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,QAAQ,CAChB,yGAAyG,EACzG,wBAAwB,EACxB,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,QAAyB,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,GAAW,EAAE,IAAe;IACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,0CAA0C,QAAQ,CAAC,KAAK,GAAG,EAC3D,wBAAwB,EACxB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAChB,kCAAkC,IAAI,eAAe,QAAQ,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,SAAS,EACjG,wBAAwB,EACxB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/src/commands/deactivate.js

@@ -1,5 +1,5 @@
 import { KeyManagerSigner } from '@did-btcr2/key-manager';
-import { deriveNetwork } from '../config.js';
+import { assertKeystoreAllowedForNetwork, deriveNetwork, resolveBroadcastOptions, resolveSigningKeyRef } from '../config.js';
 import { CLIError } from '../error.js';
 import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
 import { formatResult } from '../output.js';
@@ -16,6 +16,10 @@ export function registerDeactivateCommand(program, factory, globals) {
         .requiredOption('-b, --beacon-id <json>', 'Beacon ID as a JSON string', parseJsonArg('--beacon-id'))
         .option('--publish-to-cas <mode>', 'Publish update artifacts to a writable CAS before broadcast: auto|always|never. '
         + 'CAS publication is optional; the default distributes the returned artifacts via sidecar.', parsePublishToCasMode, 'never')
+        .option('--fee-rate <satsPerVByte>', 'Fee rate in sats/vByte for the beacon transaction (default: 5). '
+        + 'Raise it under congestion so the transaction confirms.')
+        .option('--change-address <address>', 'Send transaction change to this address instead of the beacon address, '
+        + 'so a DID\'s announcements are not linked on-chain (ADR 044).')
         .action(async (options) => {
         if (!/^\d+$/.test(options.sourceVersionId)) {
             throw new CLIError('--source-version-id must be a non-negative integer.', 'INVALID_ARGUMENT_ERROR', { value: options.sourceVersionId });
@@ -34,9 +38,18 @@ export function registerDeactivateCommand(program, factory, globals) {
         // Deactivation is an update that applies the deactivation patch. The core
         // method has no separate deactivate path, so this routes through update.
         const network = deriveNetwork(did);
+        // Refuse to sign a mainnet deactivation with an unencrypted dev keystore (ADR 080).
+        assertKeystoreAllowedForNetwork(network, globals());
         const api = factory(network, globals());
-        const keyId = resolveKeyRef(api.kms.kms, globals().signingKey);
+        const keyId = resolveKeyRef(api.kms.kms, resolveSigningKeyRef(globals()));
         const signer = new KeyManagerSigner(api.kms.kms, keyId);
+        // Resolve fee-rate/change-address through the flag -> env -> profile chain
+        // into beacon broadcast options. Undefined when neither is set, so the
+        // SDK defaults (5 sat/vB, change back to the beacon address) still apply.
+        const broadcastOptions = resolveBroadcastOptions(network, globals(), {
+            feeRate: options.feeRate,
+            changeAddress: options.changeAddress,
+        });
         // CAS publication is optional and never required: every beacon update can
         // be completed and shared via sidecar alone. It is opt-in and defaults to
         // 'never'; pass --publish-to-cas auto|always to publish the signed update
@@ -51,6 +64,7 @@ export function registerDeactivateCommand(program, factory, globals) {
             beaconId: parsed.beaconId,
             signer,
             publishToCas: options.publishToCas,
+            ...(broadcastOptions ? { broadcastOptions } : {}),
         });
         console.log(formatResult({ action: 'deactivate', data }, globals()));
     });

package/dist/esm/src/commands/deactivate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deactivate.js","sourceRoot":"","sources":["../../../../src/commands/deactivate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvF,MAAM,UAAU,yBAAyB,CACvC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,wEAAwE,CAAC;SACrF,cAAc,CACb,8BAA8B,EAC9B,qCAAqC,EACrC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,wCAAwC,CACzC;SACA,cAAc,CACb,mCAAmC,EACnC,mEAAmE,CACpE;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CACL,yBAAyB,EACzB,kFAAkF;UAC9E,0FAA0F,EAC9F,qBAAqB,EACrB,OAAO,CACR;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,wBAAwB,EACxB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,kBAAkB;YACzC,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,cAAc,EAAS,MAAM,CAAC,cAAc;YAC5C,OAAO,EAAgB,MAAM,CAAC,OAAO;YACrC,eAAe,EAAQ,MAAM,CAAC,eAAe;YAC7C,oBAAoB,EAAG,MAAM,CAAC,oBAAoB;YAClD,QAAQ,EAAe,MAAM,CAAC,QAAQ;YACtC,MAAM;YACN,YAAY,EAAW,OAAO,CAAC,YAAY;SAC5C,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,+DAA+D,EAC/D,wBAAwB,EACxB,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deactivate.js","sourceRoot":"","sources":["../../../../src/commands/deactivate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,+BAA+B,EAAE,aAAa,EAAE,uBAAuB,EAAE,oBAAoB,EAAmB,MAAM,cAAc,CAAC;AAC9I,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvF,MAAM,UAAU,yBAAyB,CACvC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,wEAAwE,CAAC;SACrF,cAAc,CACb,8BAA8B,EAC9B,qCAAqC,EACrC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,wCAAwC,CACzC;SACA,cAAc,CACb,mCAAmC,EACnC,mEAAmE,CACpE;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CACL,yBAAyB,EACzB,kFAAkF;UAC9E,0FAA0F,EAC9F,qBAAqB,EACrB,OAAO,CACR;SACA,MAAM,CACL,2BAA2B,EAC3B,kEAAkE;UAC9D,wDAAwD,CAC7D;SACA,MAAM,CACL,4BAA4B,EAC5B,yEAAyE;UACrE,8DAA8D,CACnE;SACA,MAAM,CAAC,KAAK,EAAE,OAQd,EAAE,EAAE;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,wBAAwB,EACxB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,kBAAkB;YACzC,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,oFAAoF;QACpF,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACnE,OAAO,EAAS,OAAO,CAAC,OAAO;YAC/B,aAAa,EAAG,OAAO,CAAC,aAAa;SACtC,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,cAAc,EAAS,MAAM,CAAC,cAAc;YAC5C,OAAO,EAAgB,MAAM,CAAC,OAAO;YACrC,eAAe,EAAQ,MAAM,CAAC,eAAe;YAC7C,oBAAoB,EAAG,MAAM,CAAC,oBAAoB;YAClD,QAAQ,EAAe,MAAM,CAAC,QAAQ;YACtC,MAAM;YACN,YAAY,EAAW,OAAO,CAAC,YAAY;YAC3C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,+DAA+D,EAC/D,wBAAwB,EACxB,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/src/commands/index.js

@@ -1,8 +1,10 @@
+export { registerInitCommand } from './init.js';
 export { registerCreateCommand } from './create.js';
 export { registerResolveCommand } from './resolve.js';
 export { registerUpdateCommand } from './update.js';
 export { registerDeactivateCommand } from './deactivate.js';
 export { registerKeyCommand } from './key.js';
+export { registerKeystoreCommand } from './keystore.js';
 export { registerConfigCommand } from './config.js';
 export { registerProfileCommand } from './profile.js';
 export { registerCompletionCommand } from './completion.js';

package/dist/esm/src/commands/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/esm/src/commands/init.js

@@ -0,0 +1,63 @@
+import { existsSync } from 'node:fs';
+import { defaultConfigPath, resolveKeystorePath, writeDefaultConfigFile } from '../config.js';
+import { ensureDir } from '../keystore/atomic.js';
+import { initKeystore, keystoreSummary } from '../keystore/file-key-store.js';
+import { acquirePassphrase } from '../keystore/passphrase.js';
+import { formatResult } from '../output.js';
+import { resolveHome } from '../paths.js';
+/**
+ * Registers the top-level `btcr2 init`: the one-command entry point that creates
+ * the btcr2 home (ADR 079), writes a default config if none exists, and
+ * establishes the keystore if none exists (encrypted with a confirmed passphrase
+ * by default, or `--dev` for an unencrypted testnet keystore). Idempotent:
+ * existing files are left untouched unless `--force` is given. Establishing the
+ * passphrase here, up front and confirmed, is what keeps the first `key generate`
+ * off the accidental-first-seal path (ADR 080).
+ */
+export function registerInitCommand(program, globals) {
+    const print = (result) => console.log(formatResult(result, globals()));
+    program
+        .command('init')
+        .description('Set up the btcr2 home: create the directory, a default config, and establish the keystore.')
+        .option('--dev', 'Establish an UNENCRYPTED dev keystore: plaintext keys, no passphrase. Testnet only.', false)
+        .option('--force', 'Re-create the config and keystore even if they already exist.', false)
+        .action((options) => {
+        const g = globals();
+        const home = resolveHome(g);
+        const configPath = g.config ?? defaultConfigPath(g);
+        const keystorePath = resolveKeystorePath(g);
+        ensureDir(home, 0o700);
+        const created = [];
+        // The config is regenerable, so --force may re-scaffold it.
+        if (!existsSync(configPath) || options.force) {
+            writeDefaultConfigFile(configPath);
+            created.push('config');
+        }
+        // The keystore holds unrecoverable secret keys, so `init` never overwrites
+        // an existing one, even with --force: re-establishing a keystore is the
+        // explicit, deliberate `keystore init --force`. `init` only establishes a
+        // keystore when none exists.
+        const keystoreExists = existsSync(keystorePath);
+        if (keystoreExists && options.force && !g.quiet) {
+            process.stderr.write(`note: a keystore already exists at ${keystorePath} and was left intact. `
+                + 'To re-establish it (discarding its keys), run "btcr2 keystore init --force".\n');
+        }
+        if (!keystoreExists) {
+            if (options.dev && !g.quiet) {
+                process.stderr.write('warning: establishing an UNENCRYPTED dev keystore. Keys are stored in plaintext. '
+                    + 'Use it only for disposable testnet material; mainnet operations will be refused.\n');
+            }
+            initKeystore(keystorePath, {
+                protection: options.dev ? 'none' : 'passphrase',
+                getPassphrase: (opts) => acquirePassphrase({ passphraseFile: g.passphraseFile, confirm: opts?.confirm, prompt: 'New keystore passphrase: ' }),
+            });
+            created.push('keystore');
+        }
+        const protection = keystoreSummary(keystorePath).protection;
+        print({ action: 'init', data: { home, config: configPath, keystore: keystorePath, created, protection } });
+        if (!g.quiet && g.output !== 'json') {
+            process.stderr.write(`btcr2 home ready at ${home}. Next: btcr2 key generate --set-active\n`);
+        }
+    });
+}
+//# sourceMappingURL=init.js.map

package/dist/esm/src/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../src/commands/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,OAA4B;IAChF,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4FAA4F,CAAC;SACzG,MAAM,CAAC,OAAO,EAAE,qFAAqF,EAAE,KAAK,CAAC;SAC7G,MAAM,CAAC,SAAS,EAAE,+DAA+D,EAAE,KAAK,CAAC;SACzF,MAAM,CAAC,CAAC,OAA2C,EAAE,EAAE;QACtD,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,4DAA4D;QAC5D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7C,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,6BAA6B;QAC7B,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,cAAc,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,YAAY,wBAAwB;kBACxE,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mFAAmF;sBACjF,oFAAoF,CACvF,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,YAAY,EAAE;gBACzB,UAAU,EAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;gBACnD,aAAa,EAAG,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;aAC/I,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC;QAC5D,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,IAAI,2CAA2C,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/esm/src/commands/keystore.js

@@ -0,0 +1,81 @@
+import { existsSync } from 'node:fs';
+import { resolveKeystorePath } from '../config.js';
+import { CLIError } from '../error.js';
+import { changeKeystorePassphrase, initKeystore, keystoreSummary } from '../keystore/file-key-store.js';
+import { acquirePassphrase } from '../keystore/passphrase.js';
+import { formatResult } from '../output.js';
+/**
+ * Registers the `keystore` command group: establish, inspect, and re-key the
+ * encrypted keystore (ADR 080). These operate on the keystore file directly (no
+ * Bitcoin connection or KeyManager) and never decrypt a key except when
+ * re-sealing during `change-passphrase`.
+ */
+export function registerKeystoreCommand(program, globals) {
+    const keystore = program.command('keystore').description('Establish, inspect, and re-key the keystore.');
+    const print = (result) => console.log(formatResult(result, globals()));
+    keystore
+        .command('init')
+        .description('Establish the keystore (encrypted by default). Prompts for a passphrase and confirms it.')
+        .option('--dev', 'Create an UNENCRYPTED dev keystore: plaintext keys, no passphrase. Testnet only; mainnet operations are refused.', false)
+        .option('--force', 'Re-establish even if a keystore already exists (discards its keys).', false)
+        .action((options) => {
+        const g = globals();
+        const path = resolveKeystorePath(g);
+        if (existsSync(path) && !options.force) {
+            throw new CLIError(`A keystore already exists at ${path}. Use --force to re-establish it (this discards its keys).`, 'INVALID_ARGUMENT_ERROR', { path });
+        }
+        // --force re-establishes over an existing keystore; make the key loss loud.
+        if (existsSync(path) && options.force && !g.quiet) {
+            const { keyCount } = keystoreSummary(path);
+            if (keyCount > 0) {
+                process.stderr.write(`warning: re-establishing the keystore at ${path} permanently discards its ${keyCount} existing key(s).\n`);
+            }
+        }
+        if (options.dev && !g.quiet) {
+            process.stderr.write('warning: creating an UNENCRYPTED dev keystore. Keys are stored in plaintext. '
+                + 'Use it only for disposable testnet material; mainnet operations will be refused.\n');
+        }
+        initKeystore(path, {
+            protection: options.dev ? 'none' : 'passphrase',
+            getPassphrase: (opts) => acquirePassphrase({ passphraseFile: g.passphraseFile, confirm: opts?.confirm, prompt: 'New keystore passphrase: ' }),
+        });
+        print({ action: 'keystore-init', data: { path, protection: options.dev ? 'dev' : 'encrypted' } });
+    });
+    keystore
+        .command('status')
+        .description('Show the keystore path, protection mode, and key count. Never decrypts or prompts.')
+        .action(() => {
+        const g = globals();
+        // Diagnostic command: report status even when the config is malformed,
+        // rather than crashing on the config you ran this to inspect.
+        const path = resolveKeystorePath(g, { lenient: true });
+        const summary = keystoreSummary(path);
+        if (summary.protection === 'dev' && !g.quiet && g.output !== 'json') {
+            process.stderr.write('warning: this is an UNENCRYPTED dev keystore; keys are stored in plaintext.\n');
+        }
+        print({ action: 'keystore-status', data: { path, ...summary } });
+    });
+    keystore
+        .command('change-passphrase')
+        .alias('passwd')
+        .description('Change the keystore passphrase, re-sealing every key under the new one. Encrypted keystores only.')
+        .action(() => {
+        const g = globals();
+        const path = resolveKeystorePath(g);
+        const summary = keystoreSummary(path);
+        if (summary.protection === 'absent') {
+            throw new CLIError(`No keystore at ${path}. Run "btcr2 keystore init" first.`, 'INVALID_ARGUMENT_ERROR', { path });
+        }
+        if (summary.protection === 'dev') {
+            throw new CLIError(`The keystore at ${path} is an unencrypted dev keystore; there is no passphrase to change.`, 'INVALID_ARGUMENT_ERROR', { path });
+        }
+        // Current passphrase may come from the env var / file (unattended); the new
+        // one must be entered fresh (forcePrompt) so it cannot be silently satisfied
+        // by the same source and make the change a no-op.
+        const oldPassphrase = acquirePassphrase({ passphraseFile: g.passphraseFile, prompt: 'Current keystore passphrase: ' });
+        const newPassphrase = acquirePassphrase({ forcePrompt: true, confirm: true, prompt: 'New keystore passphrase: ' });
+        const rekeyed = changeKeystorePassphrase(path, oldPassphrase, newPassphrase);
+        print({ action: 'keystore-change-passphrase', data: { path, rekeyed } });
+    });
+}
+//# sourceMappingURL=keystore.js.map